I am designing a resource request system where an user can request resource of different types. There can be many resource types such as:
- VM
- DB
- File System
- etc
Above types can have sub-types and i.e. there can be mysql
, postgresql
etc for resource type of DB
. The user can have different roles like:
- Director
- Manager
- Employee
Use Cases
A director can request any resource on behalf of any manager and its cost centre.
A manager can request any resource oh behalf of any of his cost centres.
An employee can request only those resource which is allowed by his manager.
Implementation:
For director is very easy since there is no check in the system. For manager and user I have a many to many relationship between resource type
and user
entity
Question:
I see that the system needs Roles
and Permissions
but by using these I can establish some generic rules such as the user assigned the Reporting
role can see the reports, but how to manage more granular level of permissions like a given user can only request only a given resource?